Workflow Transactional EmailWorkflow Transactional Email

Developer API and MCP

You can read your email layouts, email senders, secrets and HTTP requests from your own code or from an AI assistant, and manage your HTTP requests. Workflow Transactional Email exposes a REST API and an MCP server, both managed on the Developer page inside the app.

Everything uses one credential, and both surfaces enforce the same rules: your secrets are never readable, and history is masked before it is returned.

Related articleAuthentication and API keysCreate a key, pick its access level, and understand why execute is separate.Related articleREST API referenceEvery endpoint, the level it needs, query parameters, status codes and rate limits.Related articleConnect an AI assistant (MCP)Point Claude, Cursor, VS Code or Gemini CLI at your account, with tools gated by key level.

The short version

Base URL

text
https://shopify.workflow-transactional-email.app

Authenticate with a bearer key created on the Developer page. Keys start with fak_ and are shown once, at creation.

Three access levels, ordered and cumulative:

Level Adds
Read Read email layouts, email senders, secret names, HTTP requests, history and stats
Read & write Create, edit and delete HTTP requests
Read, write & execute Run an HTTP request against its real target

Issue read keys by default.

A first request

Confirm a key works and see what it can do:

bash
curl https://shopify.workflow-transactional-email.app/api/v1/me \
  -H "Authorization: Bearer fak_your_key_here"

Rate limits

The REST API and the MCP server share one budget per API key.

  • 300 requests per 60 seconds per key, as a fixed window.
  • Execute-level calls get a second, tighter budget of 60 per hour. They spend both, so a burst of executes also eats into the shared allowance. For this app that means running a configured HTTP request for real, against the third-party system it points at.
  • The same on every plan. Your plan meters actions, not API calls, so upgrading does not raise these numbers.
  • Going over returns HTTP 429. Back off and retry, ideally with exponential backoff.
  • If our cache is briefly unavailable the limiter fails open rather than blocking your integration.

Action execution

Flow action executions are not metered by the API limits above - they are metered by your plan's 30-day action allowance.

They do go through per-store admission control, so one store's burst cannot slow the queue for everyone else. When we are busy we signal Shopify Flow to pace its retries rather than dropping work, so nothing is lost.

Shopify's own limits

These are Shopify's limits on Shopify's APIs, not ours. They apply to what this app (and your workflows) can do on the Shopify side, and you may meet them on a large store even while well inside our limits.

  • Input arrays are capped at 250 items across every Shopify API. A request with a larger array is rejected.
  • Pagination stops at 25,000 objects. Counts are accurate up to 25,000; above that Shopify returns 25001, meaning "more than 25,000". If you need to go deeper, filter first.
  • The GraphQL Admin API is metered by calculated query cost, in points per second, and the ceiling depends on the store's Shopify plan:
Shopify plan Points per second
Standard 100
Advanced 200
Plus 1000
Enterprise (Commerce Components) 2000

The Storefront API is not rate limited.

Full detail: Shopify API rate limits